CVE-2026-108982 IDRIX CVE debrief

Who should care

macOS system administrators and users of VeraCrypt 1.26.29 (FUSE-T build) should assess exposure and update to a fixed version. This includes reviewing system configurations, verifying version numbers, and applying updates or mitigations as necessary. Additionally, security teams and vulnerability management teams should be aware of this issue to ensure proper prioritization and remediation.

Why it matters

CVE-2026-108982 allows local users or processes to access decrypted data in VeraCrypt 1.26.29 (FUSE-T build) on macOS after a volume is dismounted, requiring verification and potential updates for affected systems.

• Local users or processes can access decrypted data without a passphrase
• Decrypted volume images remain accessible over a loopback SMB session
• Leaked processes retain an open handle to the underlying raw device
• Verification of affected versions and remediation is necessary

Technical summary

VeraCrypt 1.26.29 (FUSE-T build) on macOS does not terminate the FUSE-T auxiliary service and its associated VeraCrypt core-service helper processes when a volume is dismounted. This allows a local user or process to remount and access the decrypted volume without the passphrase. The vulnerability arises from the improper handling of auxiliary services and helper processes during the dismount process, potentially leading to unauthorized access to decrypted data. A fix is available in later versions of VeraCrypt, and users should update to mitigate this vulnerability.

Defensive priority

macOS systems using VeraCrypt 1.26.29 (FUSE-T build) should verify and update to a fixed version.

Recommended defensive actions

• Verify VeraCrypt version and update to a fixed version if necessary
• Review and update access controls for decrypted volumes
• Monitor for suspicious activity related to VeraCrypt
• Perform a thorough review of system logs to detect potential unauthorized access
• Implement additional security measures such as compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Consider asset inventory and rollback/change windows for remediation planning

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and links to relevant discussions and fixes. VeraCrypt 1.26.29 (FUSE-T build) on macOS is vulnerable due to its handling of FUSE-T auxiliary services and VeraCrypt core-service helper processes during volume dismount. Evidence is based on CVE details and related reports, with limitations on source-provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.